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Abstract 

Although the security of quantum cryptography is provable based on the 
principles of quantum mechanics, it can be compromised by the flaws in the 
design of quantum protocols and the noise in their physical implementations. 
So, it is indispensable to develop techniques of verifying and debugging quan- 
tum cryptographic systems. Model-checking has proved to be effective in 
the verification of classical cryptographic protocols, but an essential diffi- 
culty arises when it is applied to quantum systems: the state space of a 
quantum system is always a continuum even when its dimension is finite. 
To overcome this difficulty, we introduce a novel notion of quantum Markov 
chain, specially suited to model quantum cryptographic protocols, in which 
quantum effects are entirely encoded into super-operators labelling transi- 
tions, leaving the location information (nodes) being classical. Then we 
define a quantum extension of probabilistic computation tree logic (PCTL) 
and develop a model-checking algorithm for quantum Markov chains. 

Keywords: Quantum Markov chains,, quantum protocols,, model checking 



1. Introduction 

Quantum cryptography, employing quantum mechanical effects to ac- 
complish cryptographic tasks, has been developed so rapidly that quan- 
tum cryptographic systems are already commercially available by a num- 
ber of companies such as Id Quantique, Cerberis, MagiQ Technologies, 
SmartQuantum, and NEC. One of the greatest advantages of quantum cryp- 
tography over its classical counterpart is that the security and ability to 
detect the presence of eavesdropping are provable based on the principles 
of quantum mechanics. In practice, however, errors which comprise this 
absolute security will still creep in at the following two levels: 
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• Protocol design level. As quantum mechanics is more or less anti- 
intuitive, quantum cryptographic protocol designers will inevitably 
make more mistakes than classical protocol designers, especially when 
more and more complicated quantum protocols can be implemented 
by future physical technology. 

• Physical implementation level. Even when the security has been proved 
for ideal quantum cryptographic protocols, the security of physically 
implemented cryptographic systems is highly difficult to guarantee, as 
any physical implementation is imperfect and attackers can disguise 
themselves as environmental noise. In fact, the commercial system 
implementing BB84 quantum key distribution protocol [4] made by 
ID Quantique has been found insure, by taking advantage of the syn- 
chronisation signals that pass between Alice and Bob [27] . 

Therefore, it is indispensable to develop methodologies and techniques for 
the verification of quantum cryptographic systems. 

Over the last four decades, model-checking [9, 2] has become one of 
the dominant techniques for verification of classical hardware as well as 
software systems, and has proved mature as witnessed by a large number 
of successful industrial applications. Model-checking techniques have also 
been widely used in the verification of security protocols [21]. One of the 
advantages of model checking is that it is usually automatic and provides 
counter-examples, which are indispensable in debugging, in case the prop- 
erty is violated. 

Given its advantage stated above, people reasonably started to explore 
the possibility of applying model-checking in the verification of quantum 
cryptographic protocols. The main obstacle for model checking quantum 
system is that the set of all quantum states, traditionally regarded as the un- 
derlying state space of the models to be checked, is a continuum. Hence the 
techniques of classical model checking, which normally work only for a finite 
state space, cannot be applied directly. Gay et al. [13, 23] provided a clever 
solution for this problem by restricting the state space to a set of finitely 
describable states called stabiliser states, and restricting the quantum oper- 
ations applied on them to the class of Clifford group. By doing this, they 
were able to obtain an efficient model checker for quantum protocols, em- 
ploying purely classical algorithms. They even developed an automatic tool 
QMC (Quantum Model-Checker) for model-checking quantum communica- 
tion protocols [14]. However, the limitation of their approach is also obvious: 
it can only check the (partial) behaviours of a protocol on stabiliser states, 
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and does not work for more general protocols. A similar idea was indepen- 
dently introduced by Hung et al. [17, 18] to synthesise quantum circuits. 
By formulating quantum logic synthesis problem vis symbolic reachability 
analysis, they were able to reduce the original problem to multiple- valued 
logic synthesis, thus simplifying the search space and algorithm complexity. 

This paper presents another solution to the problem, which applies to 
general quantum protocols. After a thorough examination of almost all ex- 
isting quantum protocols, we observe that quantum operations in these pro- 
tocols can always be dealt with in a high-level way without resorting to the 
underlying quantum states. This leads to a novel notion of quantum Markov 
chain where quantum effects are entirely encoded into super-operators la- 
belling transitions, and the nodes of its transition graph carry only classical 
information and thus they are discrete. Therefore, we circumvent the obsta- 
cle of continuous state spaces in model-checking quantum systems. However, 
the following new difficulty has to be overcome, namely, 

A prerequisite for defining probabilistic temporal logic is a suitable 
probability measure on the set of infinite paths of a Markov chain. 
Vardi [25] introduced such a measure by letting the cr-algebra be 
generated by cylinder extensions of finite paths and proved that the 
events of infinite paths specified by various temporal logical formulas 
are measurable. The probabilities of these cylinder sets are given in 
a natural way. Then the probability measure on the cylinder sets 
can be extended to Vardi's cr-algebra by the Caratheodory-Hahn 
extension theorem. For a quantum Markov chain, however, a super- 
operator valued measure instead of a numerical measure must be 
introduced because its transitions are labelled by super-operators 
instead of numerical probabilities. How can we apply Vardi's proce- 
dure to this new kind of measures? 

This paper solves the above problem by employing the Kluvanek's gener- 
alisation of the Caratheodory-Hahn extension theorem from vector measure 
theory [10]. Furthermore, we define a quantum extension of PCTL and 
develop an algorithm for model-checking quantum Markov chains. Com- 
pared to the quantum computation tree logic presented in [3], our logic is 
much simpler and more like PCTL. Consequently, a large part of classical 
techniques can be easily adapted to verify properties of quantum systems 
expressed in this logic. 

We assume the readers are familiar with the basic notions of linear al- 
gebra and quantum theory. We put a brief introduction into the appendix 
for the convenience of the readers. For more details, we refer to [22]. 
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1.1. Related work 

The mathematical structure employed in this paper to model quantum 
systems is a super-operator weighted quantum Markov chain. The idea 
of defining the denotational semantics of a quantum program as a super- 
operator was first proposed by Selinger [24]. Prior to our work, there were 
quite a few different notions of quantum Markov chains [1, 8, 11], introduced 
by authors from different research communities. The major difference is that 
in their models transitions are considered between quantum states which 
always form a continuum, whereas in our model transitions are considered 
between different points in an execution path, and quantum operations are 
treated as labels of the transitions. Consequently, the state spaces of our 
quantum Markov chains are typically finite, and classical model checking 
techniques can be easily adapted to verify quantum systems. 

A quantum Markov model similar to that used in this paper was in- 
troduced by Gudder [15] where the transition between different vertices is 
characterised by an operation matrix whose entries are super-operators and 
the sum of each column is trace-preserving. However, the motivations are 
very different: Gudder [15] aimed at defining a pure mathematical generali- 
sation of quantum walks, whereas our model is extracted from semantics of 
quantum protocols and quantum programs. 

2. Super-operators and super-operator valued measures 

For the sake of simplicity, in the following we use the term super-operator 
to denote a completely positive super-operator. Let SO{%) be the set of 
super-operators on H, ranged over by £, J 7 , • • -. Obviously, both {SO(H), 0%, +) 
and {SOiJi), Tu,o) are monoids, where Z% and 0% are the identity and 
null super-operators on H, respectively, and o is the composition of super- 
operators defined by (£oJ r )(p) = £(J 7 (p)) for any p G V(H) where V(%) is 
the set of density operators on %. We always omit the symbol o and write 
£ J- directly for £ o J 7 . Furthermore, the operation o is (both left and right) 
distributive with respect to +: 

£(T\ + T-l) = £ Ti + SF 2 , (Ji + T 2 )£ = T x £ + F 2 £. 
Thus (SO(%), +, o) forms a semiring. We will use two different orders: 
Definition 2.1. Let £ ,T G SO(H). 

(1) £ C T if for any p £ T>{H), F(p) — £(p) is positive semi- definite; 

(2) £ < T if for any p G V{%), tv(£(p)) < tr(T(p)). 
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The first order is lifted from Lowner partial order on density operators, 
whereas the second one is used to compare the ability of 'preserving trace'. 
Note that the trace of a (unnormalised) quantum state is exactly the prob- 
ability that the (normalised) state is reached [24]. Intuitively, £ < T if and 
only if the success probability of performing £ is always not greater than 
that of performing J 7 , whatever the initial state is. 

Let ~ be < H >; it is obviously an equivalence relation. Note that C is 
a partial order while < is merely a pre-order. 

Lemma 2.2. Let £,F G SO{U). Then 

(1) £ C T implies £ < T , while the inverse is not true in general. 

(2) £ < T implies £ C T' for some T' ~ T . 

Proof. (1) is obvious. To prove (2), let £ = {Ei : i £ 1} and T = {Fj : j G </} 
be the Kraus representation of £ and J 7 , respectively. Then £ < T if and 
only if G = Y^j<=j FjFj ~ Y^i&i ^l^i ls positive semi-definite. Let G = E^E 
and define the super-operator Q = {E}. Let J 7 ' = £ + Q. Then it is easy to 
check J 7 ' ~ T and £ C J-'. □ The next lemma shows that the two orders < 
and C are preserved by the right application of composition. 

Lemma 2.3. Let £,F,G G SO{U). If £ < T, then £Q < TQ, and if 
£ C T , then £Q C TQ . 

Let 

S1(U) = {£ £SO(H) :£<1 H }- 

Let SX{T-L) n be the set of ra-size row vectors over SI(T-L), and extend the 
partial order C component-wisely to it. Then we have 

Lemma 2.4. The set (5X("H) n , Q) is a complete partial order set with the 
least element (0%, . . . , 0%). 

Proof. The case when n = 1 is from [24], while the extension to n > 1 is 
obvious. □ 
With the notations and properties presented above, we can prove the 
main result of this section, which is the key to verifying the long-run prop- 
erties of quantum Markov chains. Due to lack of space, we put the proof to 
the Appendix. 

Theorem 2.5. Let T and Q be two matrices of super-operators with sizes 
n x n and 1 x n, respectively, and for each j , ^ %j + Gj < Tu- Let 

f{X)=XT + G (1) 
be a function from SO{U) n to SO{U) n . Then 
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(1) f(X) has the least fixed point, denoted by £°, in SX{T-L) n under the 
order C; 

(2) Given any £ £ ST(H) and 1 < i < n, it can be decided whether £ ~ £ f, 
~ £{<,>}, in time 0{n 2 d A ) where d = dim{T-L) is the dimension of 
H. 

To conclude this section, we introduce the notion of super-operator val- 
ued measures, which will play a role similar to probability measures for 
probabilistic model checking. 

Definition 2.6. Let ($_, S) be a measurable space; that is, U is a non-empty 
set and £ a a -algebra over Q. A function A : X — > SX(1-L) is said to be a 
super- operator valued measure (SVM for short) if IS. satisfies the following 
properties: 

(1) A(fi)~% 

(2) A(bJ iJ 4j) 7z A(Aj) for all pairwise disjoint and countable sequence 
A\, A2, ... in CI. 

We call the triple (fl, S, A) a (super- operator valued) measure space. 

Here and in the following of this paper, we always write A = Ai if 
A = [J i Ai and AiS are pairwise disjoint; that is, for any i 7^ j, A{ n Aj = 
0. SVMs enjoy some similar properties satisfied by probabilistic measures, 
which are collected as follows. 

Lemma 2.7. Let (f2, £, A) be a measure space. Then 

(1) A(0) = o n ; 

(2) A(A C ) + A(A) ~ Z% where A c is the complement set of A in Q; 

(3) (monotonic) for any A, A' G S, if A C A' then A(A) < A(A'); 

(4) for any sequence A±, A2, ■ ■ ■ in S, 

• if A\ C ^2 C . . i/ien i/iere exists a sequence £ 1 2 £2 2 • • ■ 
in SX(1-L) such that for any i, A(Ai) ~ £i, and A(U i>:L Ai) = 
lim^oo <Sj. 

• 2 4 2 ■••) £/iere exisfe a sequence £ 1 □ £2 2 • • ■ 
m SX(%) such that for any i, A(Ai) tz £ i} and A(f] i>l Ai) = 
lim.j_i.oo £i. 
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3. Super-operator weighted Markov chains 



We now extend the ordinary notion of Markov chains to super-operator 
weighted ones. 

Definition 3.1. A super- operator weighted Markov chain, or quantum Markov 
chain (qMC), is a tuple (S,Q, AP, L), where 

(1) S is a countable (typically finite) set of states; 

(2) Q : S x S — > SX(H) is called the transition matrix where for each 



(3) AP is a finite set of atomic propositions; 

(4) L is a mapping from S to 2 AP . 

A classical Markov chain may be viewed as a degenerate quantum Markov 
chain in which all super-operators appear in the transition matrix have the 
form pT-u for some < p < 1. Let M = (S, Q, AP, L) be a quantum Markov 
chain. A path ir of Ai is an infinite sequence of states sqs\ . . . where for all 
i > 0, Si £ S and Q(sj, Sj+i) / 0%. A finite path tt is a finite-length prefix 
of a path, and its length, denoted |7?|, is defined to be the number of states 
in it. We denote by the ith state of a path tt, and 7?(z) the ith state of 
a finite path n if i < \tt\. Note that we count the states in a path or finite 
path from the index 0. The sets of all infinite and finite paths of Ai starting 
in state s are denoted Path M {s) and Pathjf n (s), respectively. 

In order to reason about the behaviour of a qMC, we need to deter- 
mine the accumulated super-operator along certain paths. To this end, 
we construct a SVM Q s for each s G S as follows. For any finite path 
7? = sq • • • Sn G P a ^hfi n (s), we define the super-operator 



that is, the set of all infinite paths with prefix n. It is easy to check that 
the set 



is a semi-algebra on Path M (s). Let a mapping Q s from S M {s) to SX{T-L) 
be defined by letting Q s (0) = 0% and 



s£ S, EtesQ(-M) ~Zn; 



" " \ Q(sn-i,Sn)"-QOo,si), otherwise. 
Next we define the cylinder set CyMjt) C Path M (s) as 

Cyl(jr) = {tt G Path M (s) : tt is a prefix of 7r}; 




5 M (s) = {CyZ(7?) : tt G Pat/r 



^n(^)} U {0} 



QsiCyl^)) = Q(tt). 



(2) 
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The following theorem states that we can extend the mapping Q s de- 
fined above to a super-operator valued measure on the cr-algebra of infinite 
paths generated by cylinder extensions of finite paths, similar to Vardi's 
work for classical Markov chains [25]. The main tool we use here is the Klu- 
vanek's generalisation of the Caratheodory-Hahn extension theorem from 
vector measure theory [10]. We defer the detailed proof to the appendix for 
the sake of space limit. 

Theorem 3.2. The mapping Q s defined above can be extended to a SVM, 
denoted by Q s again, on the a -algebra generated by S M {s). Furthermore, 
this extension is unique up to the equivalence relation ~. 

To show the expressive power of quantum Markov chains, we present 
some examples. 

Example 3.3. (quantum loop programs) A simple quantum loop program, 
whose termination has been investigated extensively in [12] and [28], goes 
as follows: 



h 
h 
h 
h 



q := F{q) 
while M[q] do 
q:=S(q) 

od 



where M = Ao|0)(0| + Ai|l)(l|. The intuitive meaning of this programs 
is as follows. We first initialise the state of the quantum system q at line 
lo, by a trace-preserving super-operator T. At line l±, the two-outcome 
projective measurement M is applied to q. If the outcome Ao is observed, 
then the program terminates at line I3; otherwise it proceeds to I2 where a 
trace-preserving super-operator £ is performed at q, and then the program 
returns to line l\ and another iteration continues. 

We now construct a qMC to describe the program. Let S = {k : < 
i < 3}, AP = S, L(li) = {k} for each i, and Q be defined as Q(Iq, h) = T q , 
Q(h,h) = £° = {|0>,(0|}, Q(h,h) = S\ = {|1),(1|}, Q{h,h) = S q , and 
Q(^3^3) = The qMC is depicted in Figure 1 (the left one). Let tt = 
lohhhhhh be a finite path from Iq. Then 

Q(t?) = Q(h,h)Q(h,h)Q(li,l2)Q(l2,h)Q(h,h)Q{lo,h) = £%£\£ q £\T q . 
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Figure 1: qMCs for a quantum loop grogram (left) and BB84 protocol when n = 1 (right). 

Example 3.4. [Quantum key-distribution] BB84, the first quantum key 
distribution protocol developed by Bennett and Brassard in 1984 [4], pro- 
vides a provably secure way to create a private key between two parties, say, 
Alice and Bob. The basic BB84 protocol goes as follows: 

(1) Alice randomly creates two strings of bits B a and K a , each with size 
n. 

(2) Alice prepares a string of qubits q, with size n, such that the ith qubit 
of q is \x y ) where x and y are the ith bits of B a and K a , respectively, 
and |0 > = |0>, |0i> = |1>, |1 ) = |+) = (|0> + |1»/V2, and |lx) = 
|-) = (|0)-|l))/ v / 2. 

(3) Alice sends the qubit string q to Bob. 

(4) Bob randomly generates a string of bits Bj, with size n. 

(5) Bob measures each qubit received from Alice according to the basis 
determined by the bits he generated: if the ith bit of Bf, is k then 
he measures the ith qubit of q with {\ko),\ki)}, k = 0, 1. Let the 
measurement results be Kb, which is also a string of bits with size n. 

(6) Bob sends his choice of measurement bases B^ back to Alice, and upon 
receiving the information, Alice sends her bases B a to Bob. 
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(7) Alice and Bob determine at which positions the bit strings B a and Bb 
are equal. They discard the bits in K a and Kb where the corresponding 
bits of B a and Bb do not match. 

After the execution of the basic BB84 protocol above, the remaining bits of 
K a and Kb should be the same, provided that the communication channels 
used are perfect, and no eavesdropper exists. 

The qMC for the basic BB84 protocol in the simplest case of n = 1 is 
depicted in Fig. 1 (the right one), where Set^ is the 1-qubit super-operator 
which sets the target qubit to X = {X} and Z = {Z} are respectively 
the Pauli-X and Pauli-Y super-operators, and £ l = i = 0,1,+,—. 

As all the super-operators are applied on the same quantum qubit, we omit 
the subscripts of them for simplicity. We use the subscripts for the s-states 
to denote the choices of the basis B a of Alice, the key K a generated by Alice, 
and the basis Bb guessed by Bob. For example, in sq, B a = 0; in soi, B a = 
and K a = 1; and in sioi, B a = Bb = 1 and K a = 0. The atomic proposition 
set AP is the same as S, and L(s) = {s} for each s G S. 

We use the states succ and fail to denote the successful and unsuccessful 
termination of BB84 protocol, respectively. We take the state sioi as an 
example to illustrate the basic idea. As the bases of Alice and Bob are both 
{|+), |— )} at sioi, they will regard the key bits as the final key generated 
by the protocol. Thus if the outcome of Bob's measurement is 0, which 
corresponds to the super-operator £ + , then the protocol succeeds since Alice 
and Bob indeed share the same key bit 0; otherwise the protocol fails as they 
end up with different bits: Alice with while Bob with 1. That explains 
why we have Q(sioi> succ) = £ + while Q(sioi, fail) = £~ . Note also that at 
states sooi, son, sioo and sno Alice and Bob's bases differ, so the protocol 
will be aborted without generating any key. In these cases, the protocol 
should also be regarded as being successful. 

4. Quantum Computation Tree Logic (QCTL) 

This section is devoted to a quantum extension of classical computation 
tree logic (CTL) and probabilistic computation tree logic (PCTL). 

Definition 4.1. The syntax of quantum computation tree logic (QCTL) is 
as follows: 

$ :: = a | -1$ | $ A $ | Q~e[4>] 
4> ::= X$ | $U^$ | 
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where a is an atomic proposition, ~ G {<, >}, £ G SX{J~L), and k G N. VFe 
ca// a state formula and </> a path formula. 

Compared to the logic presented in [3], our QCTL here is simpler and 
more like PCTL: the only difference is that the formula P~ p [^>] in PCTL, 
which asserts that the probability of paths from a certain state satisfying 
the path formula (f> is constrained by ~ p where < p < 1, is replaced 
in QCTL by [</>], which asserts that the accumulated super-operators 
corresponding to paths from a certain state satisfying the formula 4> is con- 
strained by ~ £ where 0% < £ < 2^. Note that P~ p [</>] is merely a special 
case of Q~f[0] by taking £ = pin- 

Definition 4.2. Let M = (S,Q,AP,L) be a quantum Markov chain. For 
any state s G S, the satisfaction relation |= is defined inductively by 

s |= a if a € L(s) 

s \= -i$ if s Y= $ 

s |= $ A * if s \=& and s \= V 

a\=Q~e[<f>] if Q M (s,<f>)~£ 

where 

Q M (s,0) = Q s {{tt G Path M {s) | tt |= 0}), 
and for any path tt G Path M {s), 

TT \= X$ if 7T(1) |= $ 
tt |= $U- fc ^ if 3i G N.(i < k A TT{i) |= * A Vj < i.(7T(j) |= $)) 
vr |= i/ 3i G N.(ir(i) |= * A Vj < i.(vr(j) |= $)). 

Similar to PCTL, we can check that for each path formula <^> and each 
state s in a qMC A4, the set {7r G Path M (s) \ tt \= <fi} is in the a-algebra 
generated by S M (s). As usual, we introduce some syntactic sugars to sim- 
plify notations: the disjunction $iV$2 = _, ( _,v I / i A ^2), the tautology 
tt = a V -ia, the eventually operator 0^ = ttU 1 !', and the step-bounded 
eventually operator ()- k ^ = ttU- fe *. 

Example 4.3. We revisit the examples in the previous section, to show the 
expressive power of QCTL. 

(1) Example 3.3. The QCTL formula Q>g[()- k I3] asserts that the prob- 
ability that the loop program in Example 3.3 terminates within k 
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iterations is lower bounded by £. That is, for any initial quantum 
state p, the termination probability is not less than tr(£(p)). In par- 
ticular, the property that it terminates everywhere can be described 
as Q>x H [0 k}- 

(2) Example 3.4. To check the correctness of the basic BB84 protocol, 
we need to modify the atomic propositions and the labelling function 
such that AP = S U {retry}, and for each t G S, L(t) = {t} except 
that L(sooi) = -L(son) = L(sioo) = L(sno) = {retry}. The intuition 
behind this modification is, when the bases of Alice and Bob do not 
coincide, the generated key will be abandoned, and another run of the 
protocol will be made. The correctness of basic BB84 protocol can be 
stated as 

s \= ®<oJO f ail ) A ^fxtO- 4 succ \- 



5. Model checking quantum Markov chains 

As in the classical case, given a state s in a qMC M = (S,Q,AP,L) 
and a state formula <E> expressed in QCTL, model checking if s satisfies <I> is 
essentially to determine whether s belongs to the satisfaction set Sat(<&) = 
{s G S : s \= <£} which is defined inductively as follows: 

Sat(a) = {s G S : a G L(s)} 

Sat(^) = S\Sat{^>) 

Sat{^A<S>) = Sat(-$) n Sat(<5>) 

Sat(Q„ e [<i>]) = {s^S:Q M {s,4 ) )^£}. 

Most of the formulae above are the same as in probabilistic model checking. 
The only difference is Sat(Q^£[(p]). In the following, we will elaborate how to 
employ the results presented in previous sections to calculate the satisfaction 
sets for such kind of formulae. To this end, we need to compute Q M (s,4>) 
for the following three cases. 

Case 1: = X$. By definition, {vr G Path M (s) : vr |= X$} = 

Wtesat(*) c f *(«*)■ Thus 

Q M (s,X$) = Q s I l+J Cyl(st)\~ Qs(Cyl(st))= £ Q(s,t). 

\t£Sat($) J teSat(^) teSat($) 

This can be calculated easily since by the recursive nature of the definition, 
we can assume that Sat(<&) is already known. 
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Case 2: 4> = $U- fc ^. For any s G S and k > 0, we let IlJ = {it G 
Path M {s) : 7T |= <MJ^f}. Then 

CyZ(s), if sGScrf(*); 

IT; = <( 0, if s Sat($) U Sat(ty) V (k = A s G" Sat(ty)); 

Wtepostis)^- 1 , i£s€Sat(*)\Sat(*)Ak>l. 



where post(s) = {t G S : Q(s,t) 7^ 0%}, and s^"TI t _ denotes the set of 
strings obtained by appending s to strings of H k ~ l from the beginning. By 
induction on k, we can show that for each k and s, H k = or it is the disjoint 
union of some cylinder sets; to be specific, we have = l+|^ e ^fe Cyl(it) 
where 

( {s}, if s G Sat(V); 

A k =l 0, ifsgSat(<S>)USat(y)V{k = A s g Sat(V)); 

( Wtepostis) s^A k t -\ if s G Sa*(*)\5ot(*) A k > 1. 

Thus if s G Sat(^)\Sat(^f) and fc > 1, we have 

Q s (II s fe ) = Q s I l+J CyZ(7r) J = J] QsiCym) 

= E E Q(^') = E E Q(^')QM) 

tepost(s) Tr'gylj _1 tepost(s) ^'gA^ 1 

= E E QtW(^))Q(a»t) = E^( n *" 1 )Q( a ' t )- 

Adding the other two cases together, we finally have 

' I n , if s G Sa*(tf); 

0«, if s 5at($) U Sat(tf) V 

(fe = A sgSat(¥)); 
J2Q M (t,^- k ^)Q(s,t), if s G Sa*(*)\Sat(tf) A fc > 1. 

Again, this can be calculated easily since by the recursive nature of the 
definition, we can assume that both Sat($>) and Sat(^>) are already known. 

Case 3: <p = <&U*I'. In this case, we define for any s G S that Il s = 
{tt G Path M (s) : tt |= ^U^}. Similar to the bounded-until case, we get the 
equation system 

'I n , if s G Sat(tf); 

0«, if s g Sat($) U Sat^); 

, Ete5<5 M (*^U*)Q(s,t), if s G Sat{$)\Sat(V). 



Q M (s,$>U^ k y) = { 



Q M (s,<S>UV) = { 
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Figure 2: Difference between pMC and qMC 

We are interested in the least solution of this equation system, which can 
be calculated directly using Theorem 2.5. 

Recall that in probabilistic model checking, to simplify the computation 
and transfer the equation system into one with a unique solution, a pre- 
computation process is usually employed to compute all the states from 
which the probability of eventually reaching Sat(^>) without leaving states 
in Sat(<&) is exactly or 1. However, it is impossible in quantum case to 
calculate the exact set of states s for which Q M (s, <&U , 3 / ) is equivalent to 
0% or Zu without solving an equation system of super-operators. This can 
be best explained by an example. In Fig. 2 we have a pMC and a qMC with 
the same graph structure. Let Sat(&) = {1%} and Sat(&) = {lo,h}- In the 
pMC, P(Iq, ^U^) = if and only if p = or q = 0, as pq = if and only if 
p(l — q) n q = for any n > 0. However, in the qMC, things are complicated. 
First, we can not claim Q M (lo, $U\I/) 96 0% by only checking that neither 
£° nor 8 1 is 0%; they can be orthogonal with each other: let £° = Set^°\ 
S 1 = SetM, and £ = Z. Then we have Q M (l ,^U^) ~ On- Conversely, 
we can not claim Q M (lo, $U^) ~ 0% by only checking £°£ l = 0% either. 
Let £° and £ l be defined as above but let £ = X be the Pauli-X super- 
operator. Then £°X£ l ^ n , thus Q M (l , $Utf ) ^ n . To sum up, to check 
if Q- M (s, ^\J^>) ~ 0%, the accumulated super-operators along all possible 
paths from s to Sat(^) through Sat(Q), including all cycles and self-loops, 
must be considered. This is essentially as difficult as to solve the original 
super-operator equation system in which the state s is involved. Similar 
argument applies to determining if Q M (s, 3>U , 3 / ) ~ Z%. 

We have shown that in general it is not practical to pre-compute the 
two sets Sat(Q< 0w [$U*]) and Sat(Q>^ H [$U*]). Nevertheless, we can still 
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Input: Sat($) and 5ot(*) 


Input: Sot($) and 5ot(*) 


Output: A subset S° of 5 such that 


Output: A subset S 1 of 5 such that 


S\Sat(H)\Sat(<T>) C S° C Sat(Q< „ [*U*] ) 


Sot(*) cfc 5at(Q> Xji [$U*]) 


:= {s : no direct path from 5 to states in 5ai(\I/)} 


i? := Sat(tf) 


i?:=i?U(S\Sat($)\Sat(*)) 


done := false 


done := false 


while (done = false) do 


while (done = false) do 


# := R U {s 6 Sat($)\R : £ (Efl Q(*> *) ~ r } 


R := R U {,9 e S\i? : £ tEH Q(s, t) + Q(s, s) ~ 1} 


if (-/?' = R) then done := true 


if (-R' = i?) then done := true 
i? := # 


R:=R 


od 


od 


return i? 


return R 





Table 1: Algorithm to calculate S° and S x . 



simplify the calculation by identifying some and S 1 such that 
S\(Sat(V) U Sat(Q)) C5°C Sat(Q< 0n [$U*]) 

and 

which are calculated by the algorithms presented in Table 1, motivated 
by [20]. Now let S ? = S\{S° U S x ). Then for each s e S ? , 

Q M (s,<S>\JV) = Q M (t,$VV)Q(s,t) + QM)- 

te5 ? tes x 

Let T = (Q(i, s)) s t6 5? and = (X^gsz Q(s, t)) seS ? be two state-indexed 
matrices of super-operators. Then the required row vector (Q M (s, $U\l/)) se g? 
is indeed the least fixed point of the function f(X) = XT + Q in SX(T-L)^ S ' L 
We check that for each s € S 7 , 

ies ? tes ? tes 1 tes x us' ! 

Then from Theorem 2.5, we can determine whether or not Q (s, c&U^) ~ £ 
efficiently. 

Example 5.1. This example is devoted to model checking the properties 
listed in Example 4.3 against the qMCs of Examples 3.3 and 3.4. 
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(1) Quantum loop program. We only check the property Q>£r[0 h]- Let 
T = : i = 0, 1} be the super-operator which sets the target 

qubit to |+) = (|0) + |l))/\/2, £ i = i = 0, 1, and £ = X the 

Pauli-X super-operator. We first calculate that Sat(ls) = {I3} and 
Sat(tt) = {lo,h,h,h}- Then from the algorithm in Table 1 we have 
S° = 0, and S x = {l 3 }. So S ? = {l , h, h}- We proceed as follows: 



Q M (lo,Oh) = Q M (h,0h)F 
Q M (h,0h) = Q M (l 2 ,0h)£ 1 +£° 
Q M (h,0h) = Q M (h,0k)£ 

Let Q = [On, £° ,0u] with its matrix representation being 
[04x4,^0,04x4], and 



y 



T 



where 



On 


On 


On 


T 


On 


£ 


On 


S 1 


On 



M £0 = |0)(0|®|0)(0| = 



with M r 



^ 1 ^ 





\ / 



04x4 04x4 04x4 
Mjr 4X 4 M E 
4X 4 M £ i 4X 4 



,M £ i = |1)(1|®|1><1| = 



f 








\ 


























V 








1/ 



M £ = X®X 






V 1 



1 \ 




/ 



A0r = 5^|+)(»|®|+)(i| 










1 \ 

1 
1 

1 / 



Using Matlab, we find that all eigenvalues of the matrix Mj- have the 
absolute value strictly less than 1, and Mg(I - Mr)' 1 = [M, M, M] 
where 



M 



( 1 1 \ 

'0 



\ / 



|0><0|®|0><0| + |0><1|®|0><1|. 



Thus for i = 0,1,2, Q M (k,0h) = Set where Set = {|0)(0|, |0)(1|} 
X, and so k |= Q> £ [0 h] for any £ < 1. 
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k \ 


s 


SO 


«i 




«01 


SlO 


»n 


sooo 


S'OIO 


SlOl 


Sill 


succ 





On 


Oh 


0„ 


Oh 


Oh 


Oh 


0« 


Oh 


Oh 


Oh 


Oh 


Ih 


1 


H 


Oh 


Oh 


Oh 


Oh 


Oh 


Oh 


£° 


£ L 


£+ 


£- 


Ih 


2 


Oh 


Oh 


Oh 


1 £•() 

2 C 


if 1 

2 1 


2 C 


2 C 


£" 


£ x 


£+ 


£- 


Ih 


3 


Oh 


\(£ a + £ 1 X) 


|(£+ + £-.Z) 


1 £•() 

2 c 


if 1 


i£+ 


i£" 
2° 


£° 


£ L 


£+ 


£- 


2h 


4 


S £ 8* 

i€{0,l,+,-} 




A(£+ + £-.Z) 


1 pO 

2 c 


if 1 


|£+ 


2° 


£° 


f 1 


£+ 


£" 


Ih 



Table 2: Table for Q M (t,0^ k succ). 



(2) BB84 protocol. We will compute Q M (s, fail) and Q M (s, 0- 4 succ) 
separately. Table 2 calculates Q M (t,()- k succ) for each t G 5\5° 
and < /c < 4, where S 10 = {sooi> ^on, sioo ; SiiO) fail}. The item 
(^•^(sjO- 4 succ) is calculated as follows: 

Q M (s,0- i succ) = YjQ M ^^~ 3 succ )Q( s ,t) 

tes 

= l(£° + £ 1 X)Set^ + l(£ + + £:-Z)5et l+) 
8 8 

= l(Set^ + ^et 1 ^ + Set^ + Sei 1 ^) ~ 
8 2 

To compute Q M (t,§ fail), we first obtain from the algorithm in Ta- 
ble 1 that S° = {sooi, son, sioo, siio, succ}, and S x = {fail}. Then 
Table 3 computes Q M (t, fail) for each t G SX^S 1 and < fe < 4. 
The item Q'^SjO- 4 /aii) is calculated as follows: 

Q M (s,0^ fail) = Y,Q M ^<>- 3 /°*0Q(M) 

= ^(£ 4 + £ ^)5etl°> + i(f - + £+Z)Set l+) = n . 
8 8 

Note that Q M (t, 0~ k fail) = Q M (t, <>- 4 fail) for any t G 5 and fc > 4. 
We have s |= Q<o M [0 fail] A Q>ij[0- 4 succ] as expected. 

5. i . Complexity 

Recall that the overall time complexity for model checking a PCTL for- 
mula <3? against a classical Markov chain with n states is linear in |$| and 
polynomial in n, where the size |<3?| of a formula is defined to be the number 
of logical connectives and temporal operators in the formula plus the sum 
of the sizes of the temporal operators [20] . The complexity of our algorithm 
for model checking a QCTL formula <& against a qMC with n states is again 
linear in |3>| and polynomial in n and d = dim{%) as the greatest extra cost 
is the until operator but from Theorem 2.5 this cost is of the order n 2 d 4 . 
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so 




soo 


SOI 


SIO 


Sll 


sooo 


soio 


Sl()l 


Sill 





Oh 


Oh 


Oh 


O n 


Oh 


Oh 


Ok 


Oh 


Oh 


Oh 


Oh 


1 


On 


Oh 


Oh 


Oh 


Oh 


Oh 


h 




£° 


f- 


f+ 


2 


On 


Oh 


Oh 


if 1 

2° 


1 CO 

2° 




2 C ' 






£- 


f+ 


3 


Oh 


±{£ l +£°X) 


i(£~ + £+Z) 


if 1 

2° 


1 cO 

2° 


¥~ 


2° 








£+ 


4 


Oh 




i(£~ + £+Z) 


if 1 
2 C 


1 pO 
2 C 




±£+ 

2 C 


f 1 




£~ 


£+ 



Table 3: Table for Q M (t,(}- k fail). 



6. Conclusion and future works 

The main contribution of this paper is a novel notion of quantum Markov 
chains where quantum effects are entirely encoded into super-operators la- 
belling transitions, while leaving the location information being classical. 
This model is specially suited for modelling quantum cryptographic pro- 
tocols. By employing the Kluvanek's generalisation of Caratheodory-Hahn 
extension theorem from vector measure theory, we are able to define an 
appropriate super-operator valued measure on events of infinite paths in a 
quantum Markov chain. Based on this, we propose a quantum extension 
of PCTL and develop an algorithm for model-checking quantum Markov 
chains. 

We demonstrate the utility of the techniques developed in this paper by 
an example of model-checking the correctness of basic BB84 protocol. The 
properties checked in this example are essentially classical in the sense that 
what we are really concerned with is the probabilities of certain events, not 
the quantum states themselves. However, there are also quantum protocols, 
such as teleportation which can make use of a maximally entangled state 
shared between the sender and the receiver to teleport an unknown quantum 
state by sending only classical information [5] , where the properties we need 
to check are related to the resultant quantum states directly. One possible 
way of verifying such properties is to extend the atomic propositions, say, in 
the case of teleportation, to specify whether or not the accumulated super- 
operator from the initial location to the current location is proportional to 
the identity super-operator. This treatment, however, resorts to the ability 
to calculate the accumulated super-operators when constructing the model. 
Note that this can be done by the model-checking algorithm presented in 
this paper. We will further explore the possibility of this idea in our future 
work. 

The BB84 protocol is checked in this paper with the implicit assump- 
tion that no noise occurs at all. As pointed out in the Introduction, the 
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security of quantum cryptography is always compromised by the inevitable 
noise in physical implementations. A natural question then arises: can 
the techniques in the current paper be used to check security of physically 
implemented quantum cryptographic systems? This is also one of the fu- 
ture directions we are pursuing. It seems that the quantum Markov chain 
proposed in this paper is inclusive enough for this purpose because noisy 
implementation of unitary operators used in quantum communication can 
always be modelled by super-operators. 
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7. Appendix 

7.1. Basic linear algebra 

A Hilbert space % is a complete vector space equipped with an inner 
product 

(•!•) -.nxn^c 

such that 

(1) (ip\if)) > for any \tp) G with equality if and only if \tp) = 0; 

(2) = my, 

(3) ME^he^^), 

where C is the set of complex numbers, and for each c G C, c* stands for the 
complex conjugate of c. For any vector \ip) G T~L, its length |||V')|| is defined 
to be yj ('01V')) and it is said to be normalised if |||V>)|| = 1. Two vectors 
\ip) and \4>) are orthogonal if (V^) = 0. An orthonormal basis of a Hilbert 
space T-L is a basis {|z)} where each |i) is normalised and any pair of them 
are orthogonal. 

Let C(H) be the set of linear operators on H. For any A G €,(%), 
A is Hermitian if A^ = A where A^ is the adjoint operator of A such that 
(V|AT|0) = (0|A|^)* for any \tp), \<p) G Ti. The fundamental spectral theorem 
states that the set of all normalised eigenvectors of a Hermitian operator in 
C(H) constitutes an orthonormal basis for %. That is, there exists a so- 
called spectral decomposition for each Hermitian A such that 

i Xiespec(A) 

where the set {\i}} constitute an orthonormal basis of H, spec(A) denotes 
the set of eigenvalues of A, and E{ is the projector to the corresponding 
eigenspace of \. A linear operator A G C(%) is unitary if A^A = AA^ = I-^ 
where i% is the identity operator on T~L. The trace of A is defined as tr(^4) = 
^2i(i\A\i) for some given orthonormal basis {\i)} of %. It is worth noting 
that trace function is actually independent of the orthonormal basis selected. 
It is also easy to check that trace function is linear and tr(AB) = tr(BA) 
for any operators A,B G C{%). 

Let Hi and %2 be two Hilbert spaces. Their tensor product T~L\ <S> %2 
is defined as a vector space consisting of linear combinations of the vectors 
IViY^) = 1^1)1^2) = IV'i) ® 1^2) with |Vi> G Ui and \ip 2 ) G Here the 
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tensor product of two vectors is denned by a new vector such that 

^w<>j ® ^£^-i&>j =Yj\vMi)®\<t>j)- 

Then T-Li %2 is also a Hilbert space where the inner product is defined as 
the following: for any |V>i), \<f>i) G %i and ^2), \4>2) G %2, 

{ipi <8> 02|01 ® 02> = ("01 1 01 )hi {^2^2) H2 

where {• | is the inner product of Hi- For any A\ G C(Wi) and ^2 £ 
C(%2), Ai (g) y4.2 is defined as a linear operator in £(Hi <g> ^2) such that for 
each |V>i) G %i and \ip 2 ) G W2, 

The partial trace of ^4 G <8> %) with respected to %\ is defined as 

tr^ 1 (A) = ^2i(i\A\i) wri ere {\i)} is an orthonormal basis of Hi. Similarly, 
we can define the partial trace of A with respected to H.2- Partial trace 
functions are also independent of the orthonormal basis selected. 

Traditionally, a linear operator £ on C(H) is called a super-operator on 
%. A super-operator is said to be completely positive if it maps positive op- 
erators in C(H) to positive operators in C(7i), and for any auxiliary Hilbert 
space H' , the trivially extended operator Iu>®£ also maps positive operators 
in £(H' <g) H) to positive operators in C(%' <8> %). Here X-^i is the identity 
operator on £(%'). The elegant and powerful Kraus representation theorem 
[19] of completely positive super-operators states that a super-operator £ is 
completely positive if and only if there are some set of operators {Ei : i £ 1} 
with appropriate dimension such that 

£(A) = Y,EiAE} 
iei 

for any A G C(1~L). The operators Ei are called Kraus operators of £. We 
abuse the notation slightly by denoting £ = {Ei : i G /}. It is worth noting 
that the set of Kraus operators is not unique and we can always take one 
such that the number of Kraus operators does not exceed a? where d is 
the dimension of the Hilbert space. A super-operator is said to be trace- 
preserving if tr(£ (A)) = tr(A) for any positive A G C{%)\ equivalently, its 
Kraus operators Ei satisfy ^ e\e>i = /. In this paper, we will use the well- 
known (unitary) Pauli super-operators X = {X},Z = {Z}, and y = {Y} 
where 

*=(;;)•*=(; -°i)- y =o »)■ 
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7.2. Basic quantum mechanics 

According to von Neumann's formalism of quantum mechanics [26], an 
isolated physical system is associated with a Hilbert space which is called the 
state space of the system. A pure state of a quantum system is a normalised 
vector in its state space, and a mixed state is represented by a density op- 
erator on the state space. Here a density operator p on Hilbert space % 
is a positive linear operator such that tr(p) = 1. Another equivalent rep- 
resentation of density operator is probabilistic ensemble of pure states. In 
particular, given an ensemble {(pi, \4>i))} where pi > 0, YliPi = 1> an d IV'j) 
are pure states, then p = X^Kl^iXV'il ^ s a density operator. Conversely, 
each density operator can be generated by an ensemble of pure states in this 
way. Let T>{T-L) denote the set of density operators on %. 

The state space of a composite system (for example, a quantum system 
consisting of many qubits) is the tensor product of the state spaces of its 
components. For a mixed state p on Tii (g>%2 5 partial traces of p have explicit 
physical meanings: the density operators tr^p and tr% 2 /9 are exactly the 
reduced quantum states of p on the second and the first component system, 
respectively. Note that in general, the state of a composite system cannot 
be decomposed into tensor product of the reduced states on its component 
systems. A well-known example is the 2-qubit state 

l*) = -L(|oo) + |ii)) 

which appears repeatedly in our examples of this paper. This kind of state 
is called entangled state. To see the strangeness of entanglement, suppose 
a measurement M = Ao[|0)] + Ai[|l)] is applied on the first qubit of 
(see the following for the definition of quantum measurements) . Then after 
the measurement, the second qubit will definitely collapse into state |0) 
or |1) depending on whether the outcome Ao or Ai is observed. In other 
words, the measurement on the first qubit changes the state of the second 
qubit in some way. This is an outstanding feature of quantum mechanics 
which has no counterpart in classical world, and is the key to many quantum 
information processing tasks such as teleportation [5] and superdense coding 
[6]. 

The evolution of a closed quantum system is described by a unitary 
operator on its state space: if the states of the system at times t\ and ti are 
pi and p2, respectively, then p2 = UpiU' for some unitary operator U which 
depends only on t\ and £2- In contrast, the general dynamics which can 
occur in a physical system is described by a trace-preserving super-operator 
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on its state space. Note that the unitary transformation U(p) = UpU^ is a 
super-operator. 

A quantum measurement is described by a collection {M m } of measure- 
ment operators, where the indices m refer to the measurement outcomes. It 
is required that the measurement operators satisfy the completeness equa- 
tion Y2 m MmM m = In- If the system is in state p, then the probability that 
measurement result m occurs is given by 

p(m) = tr (MlM mP ), 

and the state of the post-measurement system is M m pMm/p(m). 

A particular case of measurement is projective measurement which is 
usually represented by a Hermitian operator. Let M be a Hermitian operator 
and 

M= mE m (3) 

its spectral decomposition. Obviously, the projectors {E m : m € spec(M)} 
form a quantum measurement. If the state of a quantum system is p, 
then the probability that result m occurs when measuring M on the sys- 
tem is p{m) = tr(E m p), and the post-measurement state of the system is 
E m pE m /p(m). Note that for each outcome m, the map 

£m{p) = E rn pE m 
is again a super-operator by Kraus Theorem. 

7.3. Proof of Theorem 2.5 

This section is devoted to the proof of Theorem 2.5. We first recall 
some basic results from linear algebra. Let M be a squared matrix and 
M = SJS^ 1 its Jordan decomposition where S is a nonsingular matrix, 

J = diag(J ni (\i), J„ 2 (A 2 ), . . . , J„ fc (A fe )), 

and each J ni (K) is a iij x m- Jordan block with the eigenvalue Aj. Let 
M = SJS^ 1 where J is obtained from J by replacing each Jordan block 
whose associated eigenvalue has absolute value greater than or equal to 1 
with the zero block of the same size; that is J = diag(J l , J 2 , . . . , J k ) where 

{On,xn,, if |Aj| > 1; 
J rii (Xi), otherwise. 
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Lemma 7.1. IfYZ =G NM m exists, then for each m > 0, NM m = NM m . 

Proof. Suppose YZ=o NM ™ exists - Then lim m ^oo NM m = 0. Since M m = 
S^S' 1 , we have linim^oo NS J m = 0. Decompose the columns of NS 
according to the blocks of J as NS = (K\, . . . , K k ). Then 

NSJ m = {K, J™ (AO, • • • , K k J™(\ k )) , 

which implies that for each i, limm^oo Ki J™(Aj) = 0. Let || • || be an (arbi- 
trary) matrix norm. We have 

= lim ||^(Ai)|| 

= lim \\Ki\\-\\J ni {\i)\\ m 
> lim \\Ki\\ ■ \\i\ m 

m— >oo 

where the last inequality is from Theorem 5.6.9 of [16]. From this we deduce 
that Ki = for each i whenever |A;| > 1. Thus NSJ m = NSJ m , and 
NM m = NM m . □ 



Corollary 7.2. For any matrices N and M, 

oo 

NM m = N(I - M)- 1 

m=0 

provided that the limit exists. 

Proof. Observe that by definition, the spectral radius of M is strictly less 
than 1. Then from Corollary 5.6.16 of [16], / — M is invertible, and (/ — 
M)- 1 = Y.m=o M m . The result thus follows from Lemma 7.1. □ 
We also need a notion of matrix representation for super-operators, which 
was first introduced in [29]. To do this, we fix an orthonormal basis {\k) : 
k G K} of %. 

Definition 7.3. Let £ = {Ei : % G /} G SO(%) be a super- operator. The 
matrix representation of £ is defined as 

M £ = Y J E l ®E*. 

Here the complex conjugate is taken according to the orthonormal basis { \ k) : 
k G K}. 



26 



It is easy to check that M £ is independent of the choice of orthonormal basis 
and the Kraus operators E; L . 

Furthermore, we can define the matrix representation for a matrix of 
super-operators. Let T = (£ij) be an m x n-matrix of super-operators. 
Then the matrix representation of T, denoted M7-, is defined as the block 
matrix 

/ M £lA ... M £hn \ 
Ml : •. : 

V M £mA . . . M £m , n J 
where for each i and j, M £ij is the matrix representation of Eij. In par- 
ticular, let £ = (£±, . . . , £ n ) be a (row) vector of super-operators. Then 
Mg = (M £l , . . . , M £n ). We always denote by Mx the matrix representation 
of X, whenever X is a super-operator, a vector of super-operators, or a 
matrix of super-operators. 

Let \$?) = YlkeK 1^) be a (un- normalised) maximally entangled state 
m.1-L®l-L. The next lemma is from [29]. 

Lemma 7.4. Let M £ be the matrix representation of £ G SO(H). Then for 
any E G C(H), we have 

{£(E)®I u )\*) = Me(E<8>I H )\*). 

Let £ = {Ei : i G /} be a super-operator on %. Then for any k,l £ K, 

tT^Ei\l)(k\El 

iei 

tv[£(\l)(k\)} 

{*\e(\i)(k\)®i u m (4) 

(V\M £ (\l)(k\®I n )\y) 
{*\M £ \lk}. 

Note that for an operator E G C{H), (k\E\l) is exactly the Z)-th element 
of the matrix representation of E under the basis {\k) : k G if}. Lemma 7.4 
indeed provides us an efficient way to determine whether or not £ < J 7 when 
the matrix representations of £ and J 7 are given. 

7.3.1. Proof of Theorem 2.5. 

We now turn to the proof of Theorem 2.5. For the first part, we check 
that f(X) indeed maps Sl{%) n into Sl{H) n . Let £ G Sl(H) n and ^ = 
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Input: (1) An n x n matrix T = (Tij) and a 1 x n vector £/ of super-operators 
such that for each j, ^ 71. j + < 
(2) A super-operator £ e SX(H) and i such that 1 < i < n. 

Output: 'yes' if £ ~ £P and 'no' otherwise, where £° is the least fixed point of Eq.(l). 



(1) Construct Mg and M7- from Q and T, respectively; 

(2) Calculate the Jordan decomposition Mj- = SJS -1 ; 

(3) Compute Mg- = M^S(J - J)" 1 ^ 1 ; 

(4) Use the method described in Eq.(4) to determine if £ ~ £P, and output the result. 



Table 4: Algorithm for Theorem 2.5. 



/(£). Then for each j, 

n n 

Fj = E £i 7~iJ + $3 ~ E ^ + ^ ~ x ^ 



i=i i=i 



where the first inequality is from Lemma 2.3 and the fact that Si < 
Note that the function / defined in Eq.(l) is Scott continuous with respect 
to the partial order C. Then by Lemma 2.4 and Kleene fixed point theorem, 
f(X) has a (unique) least fixed point which can be written as 

00 

S° = QT m . 

m=0 

For the second part of Theorem 2.5, we first prove that the matrix rep- 
resentation of £° is 

M i0 = M § (I-M T )-\ (5) 
For any 1 < i < n and Ei G we calculate from Lemma 7.4 that 

MpiEiQln)]*) = %{Ei)®I n \V) 

i 

00 n 

= E E ^Tk^-'-Tk^Ei)®^) 

m=0 ki,...,k m =l 
00 n 

= E E ( M ~ fcl M r fcl , fc2 ---M Tw )(^®7 w )|^ 

m=0fci,...,fc m =l 
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oo 
m=0 

where (MgM™)i is the ith block of MgM™ at the corresponding position of 
Mg in Mg . Note that when Ei ranges over C(H), the state (Ei 
ranges over all pure state in % <£> %. The above equations indeed imply 

that = E™=o( M 6 M f) t . and thus M io = Y2=* m q m t- Then E q-( 5 ) 

follows from Corollary 7.2. 

An algorithm which determines for any £ G ST(H) and 1 < z < n 
if £ ~ can be sketched as in Table 4. It is easy to see that the time 
complexity of steps (1) through (4) is cn 2 , where the constant c is of the 
order d 4 , and d is the dimension of the Hilbert space %. 

7.4- Proof of Theorem 3.2 

7.4-1- Basic results for vector measures. 

We review some necessary definitions and results of vector measures. For 
more details, please refer to [10]. 

Let f2 be a non-empty set. Recall that a semi-algebra 5 on is a subset 
of the power set 2 with the following properties: 

(1) 

(2) A, B e S implies A n B G S; 

(3) A, B G S implies that A\B = (+J™ =1 A t for some disjoint A ± , . . . , A n £ 
S. 

An algebra is a semi-algebra which is further closed under union and 
subtraction; a <T-algebra is an algebra which is also closed under complement 
and countably union. Given a semi-algebra S, we denote by TZ(S) (resp. 
cr(S)) the algebra (resp. a-algebra) generated by S; that is, the intersection 
of all algebras (resp. <r-algebras) which contain S as a subset. Obviously, 
a(S) = a(K(S)). 

Recall also that a Banach space is a complete normed vector space. 

Definition 7.5. Let T C 2 , and A a function from T to a Banach space 
B. We call A a countably additive vector measure, or vector measure for 
simplicity, if for any sequence (^4j)j>i of pairwise disjoint members of T 
such that 1+]°^ Ai G T, it holds that 

oo oo 

A(l+J^) = E A (^)- 

i=l 1=1 
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Definition 7.6. Let TZ be an algebra on f2 and A : TZ — > B a vector measure. 
Let ii be a finite nonnegative real-valued measure on TZ. Then A is said to 
be ^-continuous if 

lim A(A) = 0. 

The next theorem from [10] is the key to prove Theorem 3.2. 

Theorem 7.7. [Caratheodory-Hahn-Kluvanek Extension Theorem] Let TZ 
be an algebra on Q and A : 1Z — > B a bounded vector measure. If there 
exists a finite and nonnegative real-valued measure fi on 1Z such that A is 
fi- continuous, then A can be uniquely extended to a vector measure A' : 
cr(lZ) — > B on the a-algebra generated by 1Z such that 

A' (A) = A(A) for any A £ TZ. 

7.4-2. Banach space of Hermitian-preserving mappings. 

Suppose Ti is a Hilbert space. Let HV(W) be the set of Hermitian- 
preserving linear mapping on C(H); that is 

riV{%) = {£ 6 C{C(H)) I £{E) is Hermitian provided that E is Hermitian}. 

It is easy to show that £ is Hermitian-preserving if and only if for any 
E G C(H), £{E^) = £(E)l Obviously, {HV(H),+,o) forms a ring, and 
the orders C and < defined in Definition 2.1 can be lifted to rlV{rl). We 
denote by UV^(U) the quotient set of HV{H) by ~, and [£] G UV^{U) 
the equivalent class of £ G rlV(Ti). Note that although the quotient set 
H'P 7Z (7i) is again an Abelian group with respect to the addition +, by defin- 
ing [fj + fJ 7 ] = [f+J 7 ], the composition o is not even well defined in rlV^{Tl): 
Let £ = {o~i} be the Pauli-X super-operator, and Q = {|0)(0|}. Then 
[£} = [X H ], but Q£ ^ gi H since tr(0£(|O)(O|)) = while tr(0X w (|O)(O|)) = 1. 

We further extend the pre-order < to the quotient set HV^(W) by letting 
[£] ^5 [F\ ^ £ IS ^ i s eas Y to check that this definition is well defined, 
and < becomes a partial order in riV^{ri). 

Lemma 7.8. 

(HP^(H),\\- 
by 



Proof. Note that rlV(H) is a finite dimensional vector space over the field 
of real numbers. Thus (HV, || • ||) is a Banach space, and so is the quotient 
space {HP^(H), \\ ■ ||^). □ 
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Let || • || be an arbitrary operator norm. Then the quotient set 
|-) is again a Banach space, where the norm \\ • ||- is defined 

\\[£]\U = inf 



7.4-3. Proof of Theorem 3.2. 

We are now ready to prove Theorem 3.2. To do this, we first note that 
any super-operator is a Hermitian-preserving mapping; that is SO(H) C 
%V(%). So we can regard the mapping Q s defined in Eq.(2) as from S M (s) 
to tHV(H). Let Q' s be a mapping from S M (s) to HV^(tH) such that for any 
A G S M (s), 

Q' S (A) = [Q S (A)]. 
Then we have the following lemmas. 

Lemma 7.9. The mapping Q' s defined above is a bounded vector measure 
over S M (s). 

Proof. We only need to check that Q' s is countably additive. Let ^ A = 
l+J i>1 Ai for a disjoint sequence (Ai)i>\ in S M (s) and A G S M (s). We need 
to show that 

Q' s (A) = ^Q's(A t ). (6) 

i>i 

Without loss of generality, we assume that the sequence (Ai) has been ar- 
ranged such that all empty sets, if there are any, are put at the tail of the 
sequence; that is, whenever A n / then Ai / for any i < n. 

We claim that there are only finitely many nonempty sets in the se- 
quence; that is, there exists n such that Ai ^ if and only if % < n. We 
prove this claim by contradiction. Suppose A = Ci/1(ttq), and for each i > 1, 
Ai = Cylijfi) where all 7?jS are in Path^ n (s). By the fact that (Ai) are dis- 
joint, we know that 7?i cannot be a prefix of TTj whenever i / j. Let IT = {rfi : 
i > 1}. For any tt G Pathjf n (s), let Ind% = {i > 1 : tt is a prefix of 7?j}, and 

K = {tt G Path^ n (s) : Jnc^ is infinite}. 
Obviously, K n II = 0. Note that 7ro £ ^ and for any tt <E K, since 

Ind^f = |+J Ind^-f, 
teS 

there exists £ S such that TT^t^ G again. Thus we can extend 7?o to a 
(infinite) path tt G Path M (s) such that any finite-length prefix tt of tt with 
> |^o| is not included in II. Thus for any i, tt G" Aj, contradicting the 
fact that tt £ A. 

With the claim in hand, we let N = max{|7?j| : 1 < i < n} and ILv = 
{tt G II : |7r| = N}. Obviously, we can partition IIjv into several disjoint 
subsets such that each one contains exactly |5| elements with the same 
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N — 1-length prefix; that is, there exists a set {tt[, . . . ,7?/ } such that for 
each 1 < i < In, | vf^ | = N — 1, and 

/at 

n^v = l+J njv where 11^ = {n'^t :t£ S}. 
i=i 

We delete Ily from II and add tt^, 1 < z < In, into it. Denote by II<jv-i 
the resultant set. Then each element in n<jv-i has length less than N, and 
it is easy to check that 

In ^_ 

E Q(?f) ~ E thus E Q(^) ~ E Q^)- 

7reiijv »=i Tfen Tfen^jv-i 

Proceeding in this way, we can construct a sequence of sets IL, |tto| < i < N, 
such that for any i, J2wen < Q(^) ~ Swen< 1 Q(^) where II<7v = II. Note 
that n<|5f | = {ttq}. We finally have 

E^w = E[Q(^)i = [Q(^)l = 

i>i ffen 

That completes the proof of the lemma. □ 

Lemma 7.10. The mapping Q' s defined above can be extended uniquely to 
a vector measure, denoted by Q' s again, from a{S M {s)) toHV^(H). Fur- 
thermore, for any A G a(S M (s)), 

[On] < Q's(A) < [1 H ]. (7) 

Proof. Let 1Z = 1Z(S M (s)) be the algebra generated by S M (s). Obviously, 
we have 

n 

K = {A : A = [+J Ai for some n > 0, Ai € 5 M (a)}. 

i=l 

We extend the mapping Q' s to 7?. by defining Q' s (\i)7=i -^i) = S=i Q's(Ai), 
which turns out to be a bounded vector measure from 1Z to HV^(W). Let 
Us be a mapping defined as follows: 

• /x s (0) = 0, and for any A = Cyl(9) G <S^(s), /i a (A) = tr(Q(v?)(p m )) 
where p m = Ifc m w\/dim(Ji) is the maximally mixed state in V{T-i); 

• for any disjoint sets A\,...,A n in S M (s), // s (1+)"= 1 ^i) = Z)i=i Ms(^i)- 
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Then p s is indeed a finite and nonnegative real-valued measure on 1Z, since 
p s (Path M (s)) = p s (Cyl(s)) = tr(Xft(/? m )) = 1. Note that for any super- 
operator £ = {Ei : i G /}, tr(£ (p m )) = J2i<=i ll-^lll where || • H2 is the 
Euclidean norm. It follows that if lim^oo tr(£ i(p m )) = 0, where (£j)i>i 
is a sequence of super-operators, then lim^oo [£ j] = [0%]. So we have 
lim^^-^o Qs(-A) = [0-h], which means that Q' s is ^-continuous. 

Now using Theorem 7.7, we can extend Q' s uniquely to a vector measure 
Q' s : a(S M (s)) — > %V 7Z {%). In the following, we show that the extension 
satisfies Eq.(7). By the additivity of Q' s , it suffices to show that for any 
A e a(S M (s)), [0 n ] < Q' S (A); that is, for any p G V(H), tv(Q' s (A)(p)) > 0. 
Let n p : cr(S M (s)) -»• M be defined as 

VAGa(5- M ( S )):/, p (A) = tr(Q;(^)(p)). 

Then obviously, p p is an (ordinary) real- valued measure over a(S M (s)) and 
its restriction on S M (s), denoted fJ. p \sMr s \, is a probabilistic measure. Now 
from Caratheodory Theorem for probabilistic measures [7], p P \sM( s \ can 
be uniquely extended to a probabilistic measure p! p over a{S- M {s)). Then 
we have tr(Q' s (A)(p)) = p p (A) = p' p (A) > by the uniqueness of such 
extension. □ 
With the two lemmas above, we can easily prove Theorem 3.2. For 
any A G a(S (s)), let Q S (A) be any super-operator in the equivalent class 
Q' S (A). It is easy to check that such an extension is indeed a SVM, and it 
is unique up to the equivalence relation ~. 
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